Description

A vulnerability was detected in GPAC up to f1219cde. Affected by this vulnerability is the function gf_node_get_field of the file scenegraph/base_scenegraph.c of the component MP4Box. Performing a manipulation results in heap-based buffer overflow. The attack is only possible with local access. The exploit is now public and may be used. Upgrading to version abi-16.23 addresses this issue. The patch is named 49dee5cad329cfed310c1682703df7daa47df31a. The affected component should be upgraded.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-13T19:16:53.183Z",
  "pubdate": "2026-09-13T19:16:53.183Z",
  "executiveSummary": "A heap-based buffer overflow vulnerability has been identified within the GPAC multimedia framework, specifically affecting the MP4Box component.\nThe vulnerability resides in the gf_node_get_field function located within the scenegraph/base_scenegraph.c source file.\nThe flaw allows an attacker with local access to trigger an out-of-bounds memory write, potentially leading to arbitrary code execution or a denial-of-service condition.\nThe issue affects all GPAC versions up to f1219cde. Given that the exploit is now public, the risk of exploitation is elevated.\nSuccessful exploitation requires local access to the system, where a malicious user could supply a crafted input file or sequence to the affected binary to trigger the overflow.\nImmediate remediation is recommended through upgrading to version abi-16.23, which incorporates the security patch identified by hash 49dee5cad329cfed310c1682703df7daa47df31a.",
  "technicalDetails": "The vulnerability is a heap-based buffer overflow stemming from improper memory management within the scenegraph/base_scenegraph.c file, specifically in the gf_node_get_field function.\nThe root cause of this vulnerability involves an insufficient bounds check or incorrect calculation of the memory buffer size required to store field information during the parsing of scenegraph structures.\nWhen MP4Box processes a maliciously crafted multimedia file, the gf_node_get_field function attempts to copy data into a pre-allocated heap buffer. If the input parameters deviate from expected sizes, the application performs a write operation beyond the allocated boundaries of the heap chunk.\nThe attack flow begins with the delivery of a specially crafted file to a system where the vulnerable MP4Box binary resides. Upon parsing the file's scenegraph definition, the internal pointers are manipulated to trigger the function's logic error.\nBecause this occurs in the heap, an attacker can potentially overwrite adjacent memory objects or metadata structures, such as function pointers or object vtables. This manipulation of heap memory provides the primitives necessary to redirect program control flow.\nThe exploitation process typically follows these steps: 1) The attacker creates a malformed MP4/scenegraph container that exceeds the predefined limits for field data retrieval in gf_node_get_field. 2) The attacker executes the vulnerable MP4Box binary locally, passing the malicious file as an argument. 3) The component attempts to retrieve field information, triggering the buffer overflow during the memory copy operation. 4) The overflow corrupts the heap, allowing the attacker to influence the instruction pointer (EIP/RIP) if targeted heap objects are controlled.\nThis vulnerability is restricted to local exploitation, requiring the attacker to either have interactive shell access or be able to initiate the execution of the MP4Box process on the target system with a file of their choosing. The post-exploitation impact includes the potential for full system compromise if the attacker successfully achieves arbitrary code execution with the privileges of the user running the MP4Box tool.\nThe issue is definitively addressed in version abi-16.23 via patch 49dee5cad329cfed310c1682703df7daa47df31a, which implements robust size validation to prevent the out-of-bounds write."
}